pwnProhard

Astralogy

kalmarctf2026

Task: Hobby OS (Astral OS) kernel exploitation under QEMU with SMEP, patched pread/pwrite. Solution: Find iovec_user_check() bug in readv/writev that skips validation when first iovec has len=0, use pipe-based kernel read/write to overwrite process credentials for privilege escalation.

$ ls tags/ techniques/
privilege_escalationqemukernelosdeviovecdata_only_exploitarbitrary_read_writecred_overwritehobby_os
iovec_validation_bypasskernel_arbitrary_read_writepipe_based_kernel_rwcredential_overwritedata_only_kernel_exploit
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups